US20070074282A1 - Distributed SSL processing - Google Patents

Distributed SSL processing Download PDF

Info

Publication number
US20070074282A1
US20070074282A1 US11506403 US50640306A US2007074282A1 US 20070074282 A1 US20070074282 A1 US 20070074282A1 US 11506403 US11506403 US 11506403 US 50640306 A US50640306 A US 50640306A US 2007074282 A1 US2007074282 A1 US 2007074282A1
Authority
US
Grant status
Application
Patent type
Prior art keywords
ssl
server
data
client
certificate
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US11506403
Inventor
Jeffrey Black
Kwok Lee
Myron Zimmerman
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Certeon Inc
Original Assignee
Certeon Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/16Implementing security features at a particular protocol layer
    • H04L63/166Implementing security features at a particular protocol layer at the transport layer
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0471Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding

Abstract

Methods and systems for communicating data between a server and a remote client computer through a secure socket layer (“SSL”). In accordance with the present invention, server-side SSL functions are performed by a network device located remotely from a secure data center, while maintaining the secure use of centralized certificates and their associated private keys. The invention may be employed in conjunction with acceleration functions operating within coordinated network devices, facilitating acceleration of overall SSL traffic. The invention improves on the prior art by allowing the remotely located acceleration device to use the certificate and private key of the target application server, but without compromising the security of the server's private key.

Description

    CROSS-REFERENCE TO RELATED CASES
  • [0001]
    This application claims the benefit of U.S. Provisional Patent Application No. 60/709,641, filed on Aug. 19, 2005, which is hereby incorporated by reference as if set forth herein in its entirety.
  • FIELD OF THE INVENTION
  • [0002]
    This invention relates to a method and system for communicating data and, more particularly, to a method and system for communicating data between a server and a remote client computer through a secure socket layer (“SSL”) connection.
  • BACKGROUND OF THE INVENTION
  • [0000]
    Communication Security
  • [0003]
    The use of data networks today increasingly mandates secure communication between a client's computer and a server computer. Situations in which, for example, a customer interacts with a banking software application over the Internet to pay bills or transfer funds between accounts, or engages in on-line shopping using a credit card, require confidence in the security of the data transmitted. Even within closed networks such as an enterprise's intranet, administrators often require that sessions between browsers and mission-critical application servers be carried out over secure connections to minimize the chance of unauthorized data access.
  • [0004]
    A secure connection typically requires two criteria: authentication and encryption. Authentication refers to a mechanism whereby one party in an end-to-end communications session can positively verify the identity of the other. Such a mechanism prevents, for example, a server running malicious software from masquerading as a trustworthy server and collecting an unwitting consumer's credit card information. Authentication of clients may be performed by server-based software to prevent the disclosure of sensitive information to unauthorized persons.
  • [0005]
    To thwart eavesdropping between properly authenticated machines, the information flow between a client and a server is encrypted. Encryption typically involves the use of numerical keys which are known to the sender and receiver. These keys are used to generate pseudo-random numerical sequences with specific cryptographic algorithms which, in combination with input data, generate encrypted data suitable for transmission. Without the keys, eavesdroppers cannot decipher the encrypted data passing between the client and the server. Much research has been done in the development of currently available cryptographic algorithms.
  • [0006]
    In recent years, SSL has become a widely-adopted technology for facilitating secure communications between client and server computers. SSL utilizes both symmetric and asymmetric cryptographic techniques. Symmetric cryptography refers to techniques where the same key is used for both encryption and decryption. In contrast, asymmetric methods such as public key cryptography use different keys for encrypting data and decrypting data. In SSL, public key cryptography is generally used to initialize a secure session between client and server computers. Following session initialization, symmetric cryptography is used to encrypt and decrypt session data passing between them.
  • [0007]
    During SSL session initialization, the client and server computers exchange ‘hello’ messages by which they negotiate the SSL version, a session identifier, and the cipher suite specifying the cryptographic and key exchange algorithms. They also exchange random numbers for use in generating various session-specific keys. Optionally, a certificate may also be sent by either side in order to authenticate its identity to the other. The certificate is a data object (formatted according to a well-known standard such as ANSI X.509) that contains various information including the identity of the sender. Depending on use, the identity may be a user or computer name, a serial number, a fully qualified domain name, or some other identifier. The certificate also contains the public key of the sender as well as the identity of a certificate authority (CA) that issued the certificate. Because the purpose of the certificate is to verify the identity of the sender, the certificate should itself be verifiable. This may be accomplished by having the certificate generated and issued by a trusted CA, one known or approved of by the receiver of the certificate, such as VeriSign, Inc. The CA may also be a trusted service running within an enterprise's network.
  • [0008]
    SSL also allows for the chaining of intermediate certificates and CAs back to a well-known CA for final verification. In generating the certificate, the CA “signs” it by including an MD5 or similar digest of the certificate's contents and encrypting this digest with its own private key. During SSL session initialization, the certificate can then verified by a receiver by decrypting the “signature” using the CA's public key and validating it against the certificate's computed digest.
  • [0009]
    At this point in session initialization, basic parameters have been negotiated, one or both sides have been authenticated, public key(s) have been exchanged, and seed material for session-specific keys has been exchanged in the form of client- and server-generated random numbers. The last step prior to data transfer is to generate and exchange a “pre-master” key from which various session-specific keys are derived. This is typically accomplished by having the client generate a random number (the pre-master key), encrypt the number with the server's public key (from the server's certificate), and send the encrypted pre-master key to the server in the form of a client key exchange message. The server then decrypts the pre-master key using its own private key. The client and server sides, both now in possession of the common pre-master key, can use it to derive common session-specific keys, including client and server message authentication keys, data (write) keys, and optionally, initialization vectors. It is these keys that both sides use in conjunction with the negotiated cryptographic algorithm to encrypt and decrypt session data. Because the same keys are used for both encryption and decryption, this phase of an SSL session uses symmetric cryptography.
  • [0000]
    SSL Offload
  • [0010]
    Cryptography in general, and public key cryptography in particular, generally requires significant computing resources. This demand is particularly acute in centralized computing environments where application servers must initialize and maintain secure sessions with hundreds or thousands of clients simultaneously. For this reason, recent years have seen the emergence of dedicated network devices whose purpose is to relieve application servers of SSL functions. As shown in FIG. 1, these devices 116 typically occupy a secure location within the centralized data center 112, along with the application servers 120, 120′, 120″ themselves. These devices 116 act as proxies, intercepting incoming SSL session traffic from clients 100, 100′, 100″, performing server-side SSL functions on behalf of the application servers 120, 120′, 120″, and passing non-SSL (i.e., clear) traffic to and from the application servers 120, 120′, 120″. Because the application servers 120, 120′,120″ do not perform the SSL functions themselves, their computational burdens are greatly reduced. It should be noted that dedicated SSL offload devices 116 generally have specialized cryptographic hardware that allows for higher performance than generalized servers performing software-based cryptography.
  • [0011]
    This centralized approach for SSL offload is especially feasible when the offload devices 116 are co-located with the application servers 120, 120′, 120″ inside secure data centers 112, in which case clear traffic is permissible between them and the application servers 120, 120′, 120″. Furthermore, the certificates authenticating the application servers 120, 120′, 120″, and their corresponding private keys, can be safely installed on the offload devices 116—a requirement for terminating the SSL connections 108 from clients 100, 100′, 100″. Because the devices 116 can securely utilize the application servers'certificates for authentication to clients 100, 100′, 100″, administrators are not burdened with maintaining additional certificates for the SSL offload devices 116 themselves, and the SSL offload function remains transparent to clients 100, 100′, 100″.
  • [0000]
    Application Acceleration and SSL
  • [0012]
    In recent years, vendors have developed network devices whose purpose is to accelerate the performance of software applications running over a wide area network (“WAN”). While these devices can undertake a number of network-related functions, they typically perform one or more techniques for data reduction, including but not limited to packet-level data compression, caching, and object differencing.
  • [0013]
    As shown in FIG. 2, such acceleration devices 208, 232 are typically deployed in enterprise networks for the purpose of accelerating traffic between client (e.g., employee) computers 200, 200′, 200″ located in a remote office 204, and servers 240, 240′, 240″ located in a central data center 228. The acceleration devices 208, 232 inspect the traffic and perform data reduction on the data contained therein. However, as shown in FIG. 2, the presence of SSL in such a system inhibits the acceleration devices'208, 232 ability to reduce traffic data. This is because encryption of the SSL session traffic not only obfuscates the data, but also effectively randomizes it as well. Random data is theoretically incompressible because it contains no redundant information.
  • [0014]
    One possible solution to the problem of accelerating SSL session traffic is to distribute the server-side SSL termination point (otherwise located in the SSL offload device in the data center) out to the remote office. As shown in FIG. 3, an acceleration device 308, performing the functions of SSL termination 312, acceleration 316, and Virtual Private Network (VPN) 320, resides at a remote office location 304. A second acceleration device 348, containing the functions of VPN 352 and acceleration 356, resides at a data center location 344. In such a system, the remote office acceleration device 308 performs the server-side SSL function, thereby terminating the SSL connection 324 from the client 300, 300′, 300″ locally. Having terminated the SSL connection 324, the device 308 can effectively accelerate the non-encrypted traffic. Because security remains a requirement in managing traffic between the remote office and data center, the acceleration device 308 may also contain a VPN function 320 which, among other things, performs encryption and decryption of accelerated traffic 332 traversing the WAN 340. The acceleration device 348 located in the data center 344 performs the corresponding functions of acceleration 356 and VPN 352 as it processes traffic 328 to and from the remote office acceleration device 308.
  • [0015]
    In implementing this SSL acceleration system, the matter of authenticating the remote office acceleration device during SSL session initialization must still be resolved. More specifically, if the device terminates a client-initiated SSL session on behalf of the target application server, what certificate should it use and how should the corresponding private key be managed:
  • [0016]
    1. Installation of Server Certificates and Keys. This method simply calls for the installation of application server certificates and their corresponding private keys onto the remote acceleration devices, in a manner similar to their installation on the centralized SSL offload devices shown in FIG. 1. However, unlike centralized data center devices, the remote acceleration devices are generally located in environments with minimal network or physical security. Therefore, this technique jeopardizes the security of server private keys and thus is generally considered unacceptable.
  • [0017]
    2. Installation of Authenticated Certificates and Keys. This method calls for the issuance and installation of (new) authenticated certificates and their corresponding private keys onto each of the individual remote acceleration devices. Application server certificates and keys are not used for authentication and thus can remain securely in the data center. While this method maintains an acceptable level of security, it carries a significant management burden. Specifically, administrators have to manage the issuance, installation, and ongoing maintenance of certificates for all such remote devices. If a commercial CA is used, recurring costs may also be appreciable, particularly where large numbers of device certificates are necessary.
  • [0018]
    3. Installation of Non-authenticated Certificates and Keys. This is a simplified method in which each remote device uses a certificate (perhaps even one assigned at manufacturing time) that cannot be authenticated by a trusted CA. While this greatly reduces management complexity and cost, it weakens overall system security. Specifically, in order to make an SSL connection (with a remote acceleration device performing SSL termination on behalf of an application server), the client will have to explicitly trust the identity of the acceleration device, since its certificate cannot be authenticated by a trusted CA. This is usually done via a pop up window from the client's web browser. Requiring the client to trust an unauthenticated device or computer is generally considered an unacceptable security risk.
  • [0019]
    Accordingly, a need exists for improved authentication techniques that accommodate remote acceleration devices.
  • SUMMARY OF THE INVENTION
  • [0020]
    In accordance with the present invention, server-side SSL functions are performed by a network device located remotely from a secure data center, while maintaining the secure use of centralized certificates and their associated private keys. The invention may be employed in conjunction with acceleration functions operating within coordinated network devices, facilitating acceleration of overall SSL traffic. Embodiments of the invention allow the remotely located acceleration device to use the certificate and private key of the target application server without compromising the security of the server's private key. In employing the invention, system administrators can reduce certificate management complexity and cost while maintaining an adequate level of security.
  • [0021]
    In one embodiment, the server-side SSL function is partitioned into two discrete functions: the SSL Certificate Manager, and the SSL Server Proxy. The SSL Certificate Manager is contained within a network device typically located within a secure data center. Its purpose is to maintain certificates and their associated private keys, and to pass requested certificates to, and service decryption requests from, one or more remote SSL Server Proxies during SSL session initialization. The SSL Server Proxy may be located in an insecure remote office location. It acts as the server side of an SSL connection on behalf of the intended target application server. During SSL session initialization the SSL Server Proxy performs SSL Hello, Certificate, KeyExchange, and Finish message processing according to the SSL specification. The SSL Server Proxy does not maintain permanently stored certificates and does not have access to the private keys associated with those certificates. For these reasons, during SSL session initialization, the SSL Server Proxy makes requests to the SSL Certificate Manager for certificates and decryption operations utilizing their private keys. Following session initialization, the SSL Server Proxy performs encryption and decryption of session traffic without further involvement from the SSL Certificate Manager.
  • [0022]
    In a first aspect, a method of securely communicating data between a server and a remote client computer includes providing an SSL server proxy and a certificate manager comprising a decryption facility. An SSL connection is established between the client computer and the server utilizing communications between the SSL server proxy and the certificate manager. The SSL server proxy is then used to conduct a SSL communication session between the client computer and the server.
  • [0023]
    In some embodiments, the SSL server proxy decrypts client-originated messages to the server, or encrypts server-originated messages to the client. Decryption and encryption by the SSL server proxy may occur without further involvement from the certificate manager. In some embodiments, the decryption facility may utilize a key and the key may be a private key. If the key is a private key, the certificate manager performs all operations using the private key so as to exclude the client computer and the SSL server proxy from access to it. In one embodiment, the SSL server proxy is co-located with the client computer. Moreover, the method may further comprise causing the SSL server proxy to terminate the SSL connection with the client computer and performing data reduction on unencrypted data traffic outside the SSL connection. In this case, the reduced data traffic may be exchanged via a virtual private network.
  • [0024]
    In another aspect, a system for facilitating secure communication of data between a server and a remote client computer comprises a certificate manager having a decryption facility; a secure socket (SSL) server proxy; a connector for establishing a SSL connection between the client computer and the server via the SSL server proxy and the certificate manager using the decryption facility; and a transceiver for conducting a SSL communication session between the client computer and the server via the SSL server proxy.
  • [0025]
    In some embodiments, the SSL server proxy may decrypt client-originated messages to the server, or encrypt server-originated messages to the client. The SSL server proxy may decrypt or encrypt without further involvement from the certificate manager. Moreover, the decryption facility may be a key. In some embodiments, this key is a private key, and the certificate manager performs all operations using the private key so as to exclude the client computer and the SSL proxy from access to it. The SSL server proxy may be co-located with the client computer. The system may also further comprise an accelerator that causes the SSL server proxy to terminate the SSL connection to the client computer, and performs data reduction on the unencrypted data traffic outside the SSL connection. In such systems with an accelerator, the reduced data traffic may be exchanged via a virtual private network.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • [0026]
    The foregoing and other objects, features, and advantages of the present invention, as well as the invention itself, will be more fully understood from the following description of various embodiments when read together with the accompanying drawings in which:
  • [0027]
    FIG. 1 presents an embodiment of a prior art system for communicating data between a server and a remote client;
  • [0028]
    FIG. 2 presents another embodiment of a prior art system for communicating data between a server and a remote client;
  • [0029]
    FIG. 3 presents still another embodiment of a prior art system for communicating data between a server and a remote client;
  • [0030]
    FIG. 4 presents an embodiment of a system for the communication of data in accord with an embodiment of the present invention; and
  • [0031]
    FIG. 5 presents the message flow for the communication of data in accord with an embodiment of the present invention.
  • DETAILED DESCRIPTION OF THE INVENTION
  • [0032]
    FIG. 4 shows one embodiment of a system in accord with the present invention. An acceleration device 480 is located in a secure data center 476, along with first and second application servers 496, 498. Another acceleration device 412 is located in a first remote office 408, along with first and second client computers 400, 404. Still another acceleration device 440 is located in a second remote office 436, along with first and second client computers 428, 432. Within the data center acceleration device 480, there exist, among others, the functions of SSL Certificate Manager 484, VPN 488, and acceleration 492. Similarly, within the remote office acceleration devices 412, 440, there exist respectively, among others, the functions of SSL Server Proxy 416, 440; acceleration 420, 444; and VPN 424, 448.
  • [0033]
    In such a system, an SSL connection 452 initiated by an SSL Client function residing on the first client computer 400 and directed toward the first application server 496 is instead processed by the acceleration device 412 located in the first remote office 408. More specifically, the SSL Server Proxy 416 within the first remote office acceleration device 412 operates in concert with the SSL Certificate Manager 484 within the data center acceleration device 480, as described above, to terminate the SSL connection 452 from the SSL Client. In doing so, data passing between the first client computer 400 and the first application server 496 in transit through both acceleration devices 412, 480, is made available to the acceleration functions in clear (non-encrypted) form. These functions may then apply any of various conventional data-reduction techniques to the traffic data to improve network and application performance. Furthermore, as shown in FIG. 4, the traffic between the first remote office 408 and the data center 476 is carried over virtual private network connections 472 as implemented by the VPN functions 488, 424 within the acceleration devices 480, 412. Traffic passing between the data center acceleration device 480 and the first application server 496 is shown transmitted over clear connections 464, though SSL connections alternatively may be used.
  • [0034]
    With continued reference to FIG. 4, SSL connection traffic passing between (a) the first client computer 400 in the first remote office 408 and the second application server 498 in the data center 476, (b) the second client computer 404 in the first remote office 408 and the first 496 and second 498 application servers in the data center 476, and (c) the first and second client computers 428, 432 in the second remote office 436 and the first and second application servers 496, 498 in the data center 476 may be processed by the acceleration devices 480, 440 as described above.
  • [0035]
    The motivation for placing the server-side SSL function (in the form of the SSL Server Proxy) in the remote office, as shown in FIG. 4, is to allow the acceleration function (within the acceleration devices) to have access to clear traffic data. However, even in the absence of traffic acceleration, systems may still benefit from distributing the server-side SSL function to the remote office. More specifically, in considering the motivation and approaches for SSL offload systems discussed earlier, it should be recognized that a system for distributed, rather than centralized, SSL offload has benefit with respect to system growth and scalability because the majority of server-side SSL processing is associated with the SSL Server Proxy (located in the remote office) and not the SSL Certificate Manager (located in the central data center). Therefore, additional SSL demand (driven by the addition of remote offices and remote office clients) can be accommodated by adding or upgrading remote office SSL offload devices with little or no impact on central data center resources. This enables a more incremental and scalable growth model as compared to centralized SSL offload systems. Such a distributed SSL offload system is identical to that shown in FIG. 4, except that no acceleration function is included in the remote office or data center devices.
  • [0036]
    FIG. 5 shows the message flow between an SSL Client 504 (a functional component of a client computer), an SSL Server Proxy 536 (a functional component of a remote office device), and an SSL Certificate Manager 544 (a functional component of a data center device) in accord with an embodiment of the present invention utilizing SSL. SSL (i.e., TLS) protocol usage and message structures are known to the art and described, for example, in RFC 2246, The TLS Protocol Version 1.0.
  • [0037]
    Referring to FIG. 5, upon system startup or periodically thereafter, the SSL Server Proxy 536 sends a GetCert 548 message to the SSL Certificate Manager 544. The purpose of this message is to retrieve certificates and their related information for any application servers on whose behalf the SSL Server Proxy 536 should act. The SSL Certificate Manager 544 responds with a list of tuples, each tuple comprising: <Certificate ID, HostAddress, SSLPort, Certificate>552. Upon receiving this response, the SSL Server Proxy 536 caches this information for subsequent use as described below.
  • [0038]
    In general, certificates are not retained for long periods within the SSL Server Proxy 536 and instead are periodically refreshed via this GetCert message—response exchange 556. Alternatively, other schemes may be used for conveying the necessary information from the SSL Certificate Manager 544 to the SSL Server Proxy 536. For instance, Certificate ID, HostAddress, and SSLPort may be sent to the SSL Server Proxy 536 during system configuration and stored there in non-volatile memory. Certificates alone may be sent later via the GetCert message—response exchange 556 and cached temporarily.
  • [0039]
    Still referring to FIG. 5, the SSL Client 504 initiates an SSL session 508 by sending a ClientHello message 520 to the SSL Server (which in this case means the SSL Server Proxy 536). The SSL Server Proxy 536 responds by sending a ServerHello message 560 and, optionally, a certificate 564. According to the negotiated cipher suite, it may also send ServerKeyExchange 568 or CertificateRequest 572 messages. In the case where a certificate 564 is sent, the certificate 564 is associated with the HostAddress and SSLPort of the IP packet carrying the ClientHello 520 message. Following these messages, the SSL Server Proxy 536 sends a ServerHelloDone 576 message to the SSL Client 504.
  • [0040]
    Still referring to FIG. 5, the SSL Client 504, upon receiving the ServerHello message 560 and certificate 564 from the SSL Server Proxy 536, and subsequently verifying the certificate as described earlier, responds by sending a ClientKeyExchange message 580 to the SSL Server Proxy 536. The ClientKeyExchange message 580 contains the pre-master key, encrypted in the public key contained in the certificate. According to the negotiated cipher suite, the SSL Client 504 may also send its own certificate 524 or CertificateVerify message 584. Following these messages, the SSL Client 504 derives the various session keys from the pre-master key and random seed material (from the ‘hello’ messages). It then performs a ChangeCipherSpec operation 588, which begins the symmetric encryption and decryption of subsequent session data. Finally, the SSL Client sends a Finished message 592 to the SSL Server Proxy 536.
  • [0041]
    Upon receiving the ClientKeyExchange message 580, the SSL Server Proxy 536 sends to the SSL Certificate Manager 544 the Certificate ID 596 of the certificate 564 (which it sent to the SSL Client 504 and thus whose public key was used by the SSL Client 504 to encrypt the pre-master key), along with the encrypted pre-master key 598 from the ClientKeyExchange message 580. Upon receiving this information, the SSL Certificate Manager 544 decrypts the pre-master key using the private key associated with the Certificate ID 502 and sends the (clear) pre-master key 506 back to the SSL Server Proxy 536. An intervening VPN will ensure the privacy of the pre-master key during this transmission.
  • [0042]
    Upon receiving the pre-master key 506 from the SSL Certificate Manager 544, the SSL Server Proxy 536 derives the various session keys from the pre-master key and random seed material (from the ‘hello’ messages). It performs a ChangeCipherSpec operation 510 that begins the symmetric encryption and decryption of subsequent session data 528, and then sends a Finished message 514 to the SSL Client 504. Finally, session data 528 is encrypted and decrypted by the SSL Client 504 and SSL Server Proxy 536.
  • [0043]
    While the invention has been particularly shown and described with reference to specific embodiments, it should be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. The scope of the invention is thus indicated by the appended claims and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced.

Claims (20)

  1. 1. A method of securely communicating data between a server and a remote client computer, the method comprising:
    a. providing an SSL server proxy, and a certificate manager comprising a decryption facility;
    b. establishing a secure socket layer (SSL) connection between the client computer and the server utilizing communications between the SSL server proxy and the certificate manager; and
    c. conducting a SSL communication session between the client computer and the server via the SSL server proxy.
  2. 2. The method of claim 1 wherein the SSL server proxy decrypts client-originated messages to the server.
  3. 3. The method of claim 2 wherein the SSL server proxy decrypts without further involvement from the certificate manager.
  4. 4. The method of claim 1 wherein the SSL server proxy encrypts server-originated messages to the client.
  5. 5. The method of claim 4 wherein the SSL server proxy encrypts without further involvement from the certificate manager.
  6. 6. The method of claim 1 wherein the SSL server proxy is co-located with the client computer.
  7. 7. The method of claim 1 wherein the decryption facility utilizes a key.
  8. 8. The method of claim 7 wherein the key is a private key and the certificate manager performs all operations using the private key so as to exclude the client computer and the SSL server proxy from access thereto.
  9. 9. The method of claim 1 further comprising causing the SSL server proxy to terminate the SSL connection with the client computer and perform data reduction on unencrypted data traffic outside the SSL connection.
  10. 10. The method of claim 9 wherein the reduced data traffic is exchanged via a virtual private network.
  11. 11. A system for facilitating secure communication of data between a server and a remote client computer, the system comprising:
    a certificate manager comprising a decryption facility;
    a secure socket layer (SSL) server proxy;
    a connector for establishing an SSL connection between the client computer and the server via the SSL server proxy and the certificate manager using the decryption facility;
    and
    a transceiver for conducting a SSL communication session between the client computer and the server via the SSL server proxy.
  12. 12. The system of claim 11 wherein the SSL server proxy decrypts client-originated messages to the server.
  13. 13. The system of claim 12 wherein the SSL server proxy decrypts without further involvement from the certificate manager.
  14. 14. The system of claim 11 wherein the SSL server proxy encrypts server-originated messages to the client.
  15. 15. The system of claim 14 wherein the SSL server proxy encrypts without further involvement from the certificate manager.
  16. 16. The system of claim 11 wherein the SSL server proxy is co-located with the client computer.
  17. 17. The system of claim 11 wherein the decryption facility utilizes a key.
  18. 18. The system of claim 17 wherein the key is a private key and the certificate manager performs all operations using the private key so as to exclude the client computer and the SSL server proxy from access thereto.
  19. 19. The system of claim 11 further comprising an accelerator that causes the SSL server proxy to terminate the SSL connection to the client computer, and performs data reduction on unencrypted data traffic outside the SSL connection.
  20. 20. The system of claim 19 wherein the reduced data traffic is exchanged via a virtual private network.
US11506403 2005-08-19 2006-08-18 Distributed SSL processing Abandoned US20070074282A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US70964105 true 2005-08-19 2005-08-19
US11506403 US20070074282A1 (en) 2005-08-19 2006-08-18 Distributed SSL processing

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US11506403 US20070074282A1 (en) 2005-08-19 2006-08-18 Distributed SSL processing

Publications (1)

Publication Number Publication Date
US20070074282A1 true true US20070074282A1 (en) 2007-03-29

Family

ID=37895763

Family Applications (1)

Application Number Title Priority Date Filing Date
US11506403 Abandoned US20070074282A1 (en) 2005-08-19 2006-08-18 Distributed SSL processing

Country Status (1)

Country Link
US (1) US20070074282A1 (en)

Cited By (27)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070038853A1 (en) * 2005-08-10 2007-02-15 Riverbed Technology, Inc. Split termination for secure communication protocols
US20080060055A1 (en) * 2006-08-29 2008-03-06 Netli, Inc. System and method for client-side authenticaton for secure internet communications
US20080133531A1 (en) * 2006-08-15 2008-06-05 Richard Baskerville Trusted Query Network Systems and Methods
US20080201465A1 (en) * 2007-02-16 2008-08-21 Microsoft Corporation Centralized Monitoring of Distributed Systems
US20080235511A1 (en) * 2006-12-21 2008-09-25 Bce Inc. Device authentication and secure channel management for peer-to-peer initiated communications
US20080235508A1 (en) * 2007-03-22 2008-09-25 Cisco Technology, Inc. (A California Corporation) Reducing processing load in proxies for secure communications
US20090083538A1 (en) * 2005-08-10 2009-03-26 Riverbed Technology, Inc. Reducing latency of split-terminated secure communication protocol sessions
US20100031337A1 (en) * 2007-04-09 2010-02-04 Certeon, Inc. Methods and systems for distributed security processing
US20100191973A1 (en) * 2009-01-27 2010-07-29 Gm Global Technology Operations, Inc. System and method for establishing a secure connection with a mobile device
US20100228968A1 (en) * 2009-03-03 2010-09-09 Riverbed Technology, Inc. Split termination of secure communication sessions with mutual certificate-based authentication
US20100299525A1 (en) * 2005-08-10 2010-11-25 Riverbed Technology, Inc. Method and apparatus for split-terminating a secure network connection, with client authentication
US20100318665A1 (en) * 2003-04-14 2010-12-16 Riverbed Technology, Inc. Interception of a cloud-based communication connection
US20110113244A1 (en) * 2006-07-31 2011-05-12 Aruba Wireless Networks Stateless cryptographic protocol-based hardware acceleration
US20110231652A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Proxy ssl authentication in split ssl for client-side proxy agent resources with content insertion
WO2011133422A3 (en) * 2010-04-21 2012-01-12 Citrix Systems, Inc. Systems and methods for split proxying of ssl via wan appliances
WO2012052434A1 (en) 2010-10-21 2012-04-26 Ipanema Technologies Method for optimizing the transfer of a stream of secure data via an autonomic network
CN101925920B (en) 2008-08-27 2012-09-26 环球标志株式会社 Server certificate issuing system and person authentication method
US20130156189A1 (en) * 2011-12-16 2013-06-20 Akamai Technologies, Inc. Terminating SSL connections without locally-accessible private keys
US20140122578A1 (en) * 2012-10-25 2014-05-01 Samsung Electronics Co., Ltd Method and apparatus for accelerating web service with proxy server
US8782393B1 (en) 2006-03-23 2014-07-15 F5 Networks, Inc. Accessing SSL connection data by a third-party
US20140373136A1 (en) * 2013-06-14 2014-12-18 Or Igelka Proactive security system for distributed computer networks
US20160309365A1 (en) * 2013-11-12 2016-10-20 Telefonaktiebolaget L M Ericsson (Publ) Remote Socket Connection for Data Offload
WO2016205238A1 (en) * 2015-06-16 2016-12-22 Amazon Technologies, Inc. Handshake offload
US9531685B2 (en) 2011-12-16 2016-12-27 Akamai Technologies, Inc. Providing forward secrecy in a terminating SSL/TLS connection proxy using Ephemeral Diffie-Hellman key exchange
US9531691B2 (en) 2011-12-16 2016-12-27 Akamai Technologies, Inc. Providing forward secrecy in a terminating TLS connection proxy
EP3085008A4 (en) * 2013-12-18 2017-06-21 Akamai Tech Inc Providing forward secrecy in a terminating tls connection proxy
US9882900B2 (en) 2014-06-26 2018-01-30 Amazon Technologies, Inc. Mutual authentication with symmetric secrets and signatures

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040015725A1 (en) * 2000-08-07 2004-01-22 Dan Boneh Client-side inspection and processing of secure content
US6971017B2 (en) * 2002-04-16 2005-11-29 Xerox Corporation Ad hoc secure access to documents and services
US20070038853A1 (en) * 2005-08-10 2007-02-15 Riverbed Technology, Inc. Split termination for secure communication protocols
US7506368B1 (en) * 2003-02-13 2009-03-17 Cisco Technology, Inc. Methods and apparatus for network communications via a transparent security proxy

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040015725A1 (en) * 2000-08-07 2004-01-22 Dan Boneh Client-side inspection and processing of secure content
US6971017B2 (en) * 2002-04-16 2005-11-29 Xerox Corporation Ad hoc secure access to documents and services
US7506368B1 (en) * 2003-02-13 2009-03-17 Cisco Technology, Inc. Methods and apparatus for network communications via a transparent security proxy
US20070038853A1 (en) * 2005-08-10 2007-02-15 Riverbed Technology, Inc. Split termination for secure communication protocols

Cited By (63)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8473620B2 (en) 2003-04-14 2013-06-25 Riverbed Technology, Inc. Interception of a cloud-based communication connection
US20100318665A1 (en) * 2003-04-14 2010-12-16 Riverbed Technology, Inc. Interception of a cloud-based communication connection
US8438628B2 (en) 2005-08-10 2013-05-07 Riverbed Technology, Inc. Method and apparatus for split-terminating a secure network connection, with client authentication
US8613071B2 (en) 2005-08-10 2013-12-17 Riverbed Technology, Inc. Split termination for secure communication protocols
US20100299525A1 (en) * 2005-08-10 2010-11-25 Riverbed Technology, Inc. Method and apparatus for split-terminating a secure network connection, with client authentication
US8478986B2 (en) * 2005-08-10 2013-07-02 Riverbed Technology, Inc. Reducing latency of split-terminated secure communication protocol sessions
US20090083538A1 (en) * 2005-08-10 2009-03-26 Riverbed Technology, Inc. Reducing latency of split-terminated secure communication protocol sessions
US20070038853A1 (en) * 2005-08-10 2007-02-15 Riverbed Technology, Inc. Split termination for secure communication protocols
US8782393B1 (en) 2006-03-23 2014-07-15 F5 Networks, Inc. Accessing SSL connection data by a third-party
US9742806B1 (en) 2006-03-23 2017-08-22 F5 Networks, Inc. Accessing SSL connection data by a third-party
US8392968B2 (en) 2006-07-31 2013-03-05 Aruba Networks, Inc. Stateless cryptographic protocol-based hardware acceleration
US8838957B2 (en) 2006-07-31 2014-09-16 Aruba Networks, Inc. Stateless cryptographic protocol-based hardware acceleration
US20110113244A1 (en) * 2006-07-31 2011-05-12 Aruba Wireless Networks Stateless cryptographic protocol-based hardware acceleration
US7966646B2 (en) 2006-07-31 2011-06-21 Aruba Networks, Inc. Stateless cryptographic protocol-based hardware acceleration
US20110173439A1 (en) * 2006-07-31 2011-07-14 Kabushiki Kaisha Toshiba Stateless Cryptographic Protocol-based Hardware Acceleration
US8775402B2 (en) * 2006-08-15 2014-07-08 Georgia State University Research Foundation, Inc. Trusted query network systems and methods
US20080133531A1 (en) * 2006-08-15 2008-06-05 Richard Baskerville Trusted Query Network Systems and Methods
US20080060055A1 (en) * 2006-08-29 2008-03-06 Netli, Inc. System and method for client-side authenticaton for secure internet communications
US8560834B2 (en) * 2006-08-29 2013-10-15 Akamai Technologies, Inc. System and method for client-side authentication for secure internet communications
US8181227B2 (en) * 2006-08-29 2012-05-15 Akamai Technologies, Inc. System and method for client-side authenticaton for secure internet communications
US20120204025A1 (en) * 2006-08-29 2012-08-09 Akamai Technologies, Inc. System and method for client-side authentication for secure internet communications
US9755825B2 (en) * 2006-12-21 2017-09-05 Bce Inc. Device authentication and secure channel management for peer-to-peer initiated communications
US20080235511A1 (en) * 2006-12-21 2008-09-25 Bce Inc. Device authentication and secure channel management for peer-to-peer initiated communications
US20080201465A1 (en) * 2007-02-16 2008-08-21 Microsoft Corporation Centralized Monitoring of Distributed Systems
US8190875B2 (en) * 2007-03-22 2012-05-29 Cisco Technology, Inc. Reducing processing load in proxies for secure communications
US8583914B2 (en) 2007-03-22 2013-11-12 Cisco Technology, Inc. Reducing processing load in proxies for secure communications
US20080235508A1 (en) * 2007-03-22 2008-09-25 Cisco Technology, Inc. (A California Corporation) Reducing processing load in proxies for secure communications
US20100031337A1 (en) * 2007-04-09 2010-02-04 Certeon, Inc. Methods and systems for distributed security processing
CN101925920B (en) 2008-08-27 2012-09-26 环球标志株式会社 Server certificate issuing system and person authentication method
US8499154B2 (en) * 2009-01-27 2013-07-30 GM Global Technology Operations LLC System and method for establishing a secure connection with a mobile device
US20100191973A1 (en) * 2009-01-27 2010-07-29 Gm Global Technology Operations, Inc. System and method for establishing a secure connection with a mobile device
US8707043B2 (en) 2009-03-03 2014-04-22 Riverbed Technology, Inc. Split termination of secure communication sessions with mutual certificate-based authentication
US20100228968A1 (en) * 2009-03-03 2010-09-09 Riverbed Technology, Inc. Split termination of secure communication sessions with mutual certificate-based authentication
US9172682B2 (en) 2010-03-19 2015-10-27 F5 Networks, Inc. Local authentication in proxy SSL tunnels using a client-side proxy agent
US8700892B2 (en) 2010-03-19 2014-04-15 F5 Networks, Inc. Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
US20110231923A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Local authentication in proxy ssl tunnels using a client-side proxy agent
US20110231651A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Strong ssl proxy authentication with forced ssl renegotiation against a target server
US20110231652A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Proxy ssl authentication in split ssl for client-side proxy agent resources with content insertion
US9705852B2 (en) 2010-03-19 2017-07-11 F5 Networks, Inc. Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
US9178706B1 (en) 2010-03-19 2015-11-03 F5 Networks, Inc. Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
US9667601B2 (en) 2010-03-19 2017-05-30 F5 Networks, Inc. Proxy SSL handoff via mid-stream renegotiation
US9166955B2 (en) 2010-03-19 2015-10-20 F5 Networks, Inc. Proxy SSL handoff via mid-stream renegotiation
US9210131B2 (en) 2010-03-19 2015-12-08 F5 Networks, Inc. Aggressive rehandshakes on unknown session identifiers for split SSL
US9100370B2 (en) 2010-03-19 2015-08-04 F5 Networks, Inc. Strong SSL proxy authentication with forced SSL renegotiation against a target server
US9509663B2 (en) 2010-03-19 2016-11-29 F5 Networks, Inc. Secure distribution of session credentials from client-side to server-side traffic management devices
US8949591B2 (en) 2010-04-21 2015-02-03 Citrix Systems, Inc. Systems and methods for split proxying of SSL via WAN appliances
WO2011133422A3 (en) * 2010-04-21 2012-01-12 Citrix Systems, Inc. Systems and methods for split proxying of ssl via wan appliances
US8543805B2 (en) 2010-04-21 2013-09-24 Citrix Systems, Inc. Systems and methods for split proxying of SSL via WAN appliances
WO2012052434A1 (en) 2010-10-21 2012-04-26 Ipanema Technologies Method for optimizing the transfer of a stream of secure data via an autonomic network
US9137264B2 (en) 2010-10-21 2015-09-15 Ipanema Technologies Method for optimizing the transfer of a stream of secure data via an autonomic network
US9531691B2 (en) 2011-12-16 2016-12-27 Akamai Technologies, Inc. Providing forward secrecy in a terminating TLS connection proxy
US20130156189A1 (en) * 2011-12-16 2013-06-20 Akamai Technologies, Inc. Terminating SSL connections without locally-accessible private keys
JP2015505994A (en) * 2011-12-16 2015-02-26 アカマイ テクノロジーズ インコーポレイテッド The end of the ssl connection that does not use an accessible private key to the local
US9531685B2 (en) 2011-12-16 2016-12-27 Akamai Technologies, Inc. Providing forward secrecy in a terminating SSL/TLS connection proxy using Ephemeral Diffie-Hellman key exchange
US9647835B2 (en) * 2011-12-16 2017-05-09 Akamai Technologies, Inc. Terminating SSL connections without locally-accessible private keys
US20140122578A1 (en) * 2012-10-25 2014-05-01 Samsung Electronics Co., Ltd Method and apparatus for accelerating web service with proxy server
US20140373136A1 (en) * 2013-06-14 2014-12-18 Or Igelka Proactive security system for distributed computer networks
US9306957B2 (en) * 2013-06-14 2016-04-05 Sap Se Proactive security system for distributed computer networks
US9826432B2 (en) * 2013-11-12 2017-11-21 Telefonaktiebbolaget Lm Ericsson (Publ) Remote socket connection for data offload
US20160309365A1 (en) * 2013-11-12 2016-10-20 Telefonaktiebolaget L M Ericsson (Publ) Remote Socket Connection for Data Offload
EP3085008A4 (en) * 2013-12-18 2017-06-21 Akamai Tech Inc Providing forward secrecy in a terminating tls connection proxy
US9882900B2 (en) 2014-06-26 2018-01-30 Amazon Technologies, Inc. Mutual authentication with symmetric secrets and signatures
WO2016205238A1 (en) * 2015-06-16 2016-12-22 Amazon Technologies, Inc. Handshake offload

Similar Documents

Publication Publication Date Title
Ylonen SSH–secure login connections over the Internet
US5923756A (en) Method for providing secure remote command execution over an insecure computer network
US7228438B2 (en) Computer network security system employing portable storage device
Sirbu et al. Distributed authentication in Kerberos using public key cryptography
US6584567B1 (en) Dynamic connection to multiple origin servers in a transcoding proxy
US5784463A (en) Token distribution, registration, and dynamic configuration of user entitlement for an application level security system and method
US7340600B1 (en) Authorization infrastructure based on public key cryptography
US7237108B2 (en) Encryption of streaming control protocols and their headers
US6775772B1 (en) Piggy-backed key exchange protocol for providing secure low-overhead browser connections from a client to a server using a trusted third party
US6874089B2 (en) System, method and computer program product for guaranteeing electronic transactions
US7584505B2 (en) Inspected secure communication protocol
US6938154B1 (en) System, method and article of manufacture for a cryptographic key infrastructure for networked devices
US8245285B1 (en) Transport-level web application security on a resource-constrained device
US6490679B1 (en) Seamless integration of application programs with security key infrastructure
US7249377B1 (en) Method for client delegation of security to a proxy
US20010023482A1 (en) Security protocol
US7231526B2 (en) System and method for validating a network session
US20040268152A1 (en) Computer-based dynamic secure non-cached delivery of security credentials such as digitally signed certificates or keys
US6681017B1 (en) Simplified secure shared key establishment and data delivery protocols for electronic commerce
US20080060055A1 (en) System and method for client-side authenticaton for secure internet communications
US20060236096A1 (en) Distributed cryptographic management for computer systems
US20020087862A1 (en) Trusted intermediary
US20050138362A1 (en) Authentication system for networked computer applications
US20010005883A1 (en) Security protocol
US20040268121A1 (en) Reducing network configuration complexity with transparent virtual private networks

Legal Events

Date Code Title Description
AS Assignment

Owner name: CERTEON, INC., MASSACHUSETTS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BLACK, JEFFREY T.;LEE, KWOK C.;ZIMMERMAN, MYRON;REEL/FRAME:018899/0653;SIGNING DATES FROM 20060909 TO 20061101